DOCUMENT ID: 57560
   SYNOPSIS: Java Secure Socket Extention (JSSE) May Incorrectly Validate
   Server Certificate
   DETAIL DESCRIPTION:

Sun(sm) Alert Notification

     * Sun Alert ID: 57560
     *
       Synopsis: Java Secure Socket Extension (JSSE) May Incorrectly
       Validate Server Certificate
     *
       Category: Security
     *
       Product: Java Secure Socket Extension
     * BugIDs: 5003433
     * Avoidance: Upgrade
     *
       State: Resolved
     * Date Released: 17-May-2004
     * Date Closed: 17-May-2004
     * Date Modified:

1. Impact

   The Java Secure Socket Extension (JSSE) may incorrectly validate the
   digital certificate of a web site thereby allowing an untrusted web
   site to be trusted for Secure Socket Layer (SSL).

2. Contributing Factors

   This issue can occur in the following releases:
     * JSSE 1.0.3, 1.0.3_01 and 1.0.3_02 for Windows, Solaris and Linux

   Note: JSSE 1.0.2 and earlier releases are not affected. JSSE in SDK
   and JRE 1.4.x are also not affected.

3. Symptoms

   There are no reliable symptoms that would show the described issue has
   been exploited.
   SOLUTION SUMMARY:

4. Relief/Workaround

   There is no workaround. Please see the "Resolution" section below.

5. Resolution

   This issue is addressed in the following release:
     * JSSE 1.0.3_03

   JSSE 1.0.3_03 is available at:
   http://java.sun.com/products/jsse/index-103.html

   This Sun Alert notification is being provided to you on an "AS IS"
   basis. This Sun Alert notification may contain information provided by
   third parties. The issues described in this Sun Alert notification may
   or may not impact your system(s). Sun makes no representations,
   warranties, or guarantees as to the information contained herein. ANY
   AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
   NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
   YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
   INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
   OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
   This Sun Alert notification contains Sun proprietary and confidential
   information. It is being provided to you pursuant to the provisions of
   your agreement to purchase services from Sun, or, if you do not have
   such an agreement, the Sun.com Terms of Use. This Sun Alert
   notification may only be used for the purposes contemplated by these
   agreements.

   Copyright 2000-2004 Sun Microsystems, Inc., 4150 Network Circle, Santa
   Clara, CA 95054 U.S.A. All rights reserved.
     _________________________________________________________________
     _________________________________________________________________

   APPLIES TO:
   ATTACHMENTS: